The United Kingdom’s National Crime Agency (NCA) disrupted a multi-billion dollar money laundering network, which provided services to a wide range of illicit actors, including Russian and international elites, cybercriminals, and drug gangs.

The NCA’s efforts, named “Operation Destabilise,” identified two Russian-speaking networks (Smart and TGR) leading these operations, which have thus far led to 84 arrests of individuals linked to these groups and the seizure of more than 20 million Euros in cash and cryptocurrency.

Today’s disruption was an internationally-coordinated effort, involving organizations including the U.K. Metropolitan Police Service, France’s Direction Centrale de la Police Judiciaire, the United States Department of the Treasury’s Office of Foreign Assets Control (OFAC), the Drug Enforcement Agency (DEA), and the Federal Bureau of Investigation (FBI), among others. This collaboration led to the arrest of another individual linked to Smart and TGR who facilitated global money laundering.

Additionally, OFAC sanctioned four entities and five individuals associated with TGR; OFAC included cryptocurrency addresses for two of the individuals:

George Rossi (AKA Maksakov, Yury, Georgy Rossi, or Heorhii Rossi): A Ukrainian national who founded TGR Partners, is the director of TGR Corporate Concierge LTD, and likely controls the TGR Group.
Elena Chirkinyan (AKA Yelena Norayrovna Chirkinyan or “Elle”): A Russian national who is Rossi’s direct subordinate, a partner at TGR Partners, the CEO of TGR Corporate Concierge LTD, and the manager of TGR DWC-LLC.
Andrejs Bradens (AKA Andrejs Carenoks): A Latvian national associated with several TGR networks.
Nikita Vladimirovich Krasnov (AKA “ACESCOM”): A Russian national who laundered cash and cryptocurrency on behalf of elite clients.
Khadzhi Murat Dalgatovich Magomedov (AKA Magomedov or Murat): A Russian national who laundered cash and cryptocurrency on behalf of elite clients.
TGR Partners: A Moscow-based organization founded by Rossi that provided services to a wide range of illicit actors, such as cryptocurrency trading, foreign exchange payments, and concierge services.
TGR Corporate Concierge LTD: A U.K.-based network controlled by Bradens. Chirkinyan is its CEO.
TGR DWC-LLC: A UAE-based network operated by Chirkinyan that provided services to help elites obscure the source of ill-gotten funds.
Siam Expert Trading Company Limited: A Thailand-based network associated with Bradens.
Pullman Global Solutions LLC (Pullman Global): A Wyoming-based organization owned by Bradens.
The cryptocurrency addresses in OFAC’s designation include a deposit address for Chirkinyan at a mainstream exchange (TDdbRFoBTEmE3qiR69Y6rKRSG1hoF65QaE) that has received over $146,000, and a high-volume wallet controlled by Magomedov (0x1999ef52700c34de7ec2b68a28aafb37db0c5ade) that has processed more than $200 million. The wallets have received high-value transfers, reflecting bulk cash transfers and transactions conducted on behalf of TGR clients.

Operation Destabilise determined that Smart, TGR, and their related networks often transferred money across borders by swapping cash and cryptocurrency. In some instances, Smart and TGR would receive funds in crypto from a client, facilitate a transfer in cash, and take a percentage of the amount. They would also follow a similar process in reverse, exchanging cash for crypto. It was unlikely that these clients would overlap, given that Smart and TGR were operating across 30 countries, and used a network of international controllers and couriers to actually perform the handovers.

The NCA also detailed that Smart and TGR provided illicit financial services on the streets in the U.K. to traditional crime groups by exchanging their cash proceeds for crypto, which they then used to further their criminal activities by paying for drugs to international cartels. Unfortunately, these networks enable serious crime in the U.K. and other countries, which threatens the country’s financial integrity and, in many cases, results in physical violence.

The United States Department of the Treasury office of foreign assets Control (OFAC) has sanctioned a UAE registered business entity and its subsidiary for helping to build or operate blockchain based services to facilitate potential sanctions evasion on behalf of Russian nationals.

The total number of sanctioned entities are twelve.

Chainalysis in a blog explored the activities of these entities including on-chain analysis of addresses identified that were associated with sanctioned businesses.

While most of the sanctioned entities and individuals are based in Russia and all of them are linked to Russia through the services they provided, one is based out of DMCC UAE (Dubai Multi Commodities Center).

The company in the UAE is called Crypto Explorer DMCC (Crypto Explorer). It operates under its business name AWEX. The company operates a Russian and UAE-based virtual currency exchange that offers conversions between virtual currencies, rubles, and UAE dirhams. In a report by Crypto defender he showcases the following information on crypto explorer. (dated 11 months ago)

According to the OFAC press release, AWEX offers cash services at its offices in Moscow and Dubai and also loads funds onto credit cards associated with OFAC-designated Russian banks such as Sberbank and Alfa-Bank. Crypto Explorer was designated pursuant to E.O. 14024 for operating or having operated in the financial services sector of the Russian Federation economy.

As for the other sanctioned entities they include

Obshchestvo S Ogranichennoy Otvetstvennostyu Kripto Eksplorer (OOO Kripto Eksplorer) is a Russian company that is solely owned by Crypto Explorer. OOO Kripto Eksplorer was designated for being owned or controlled by, or having acted or purported to act for or on behalf of, directly or indirectly, Crypto Explorer.

Joint Stock Company B-Crypto worked with OFAC-designated Rosbank to support cross-border transactions in crypto.

Obshchestvo S Ogranichennoy Otvetstvennostyu Sistemy Raspredelennogo Reyestra (Masterchain) has agreements with several OFAC-designated Russian banks to issue digital currencies.

Obshchestvo S Ogranichennoy Otvetstvennostyu Laitkhaus issued and exchanged digital currencies to support several OFAC-designated banks.

Obshchestvo S Ogranichennoy Otvetstvennostyu Atomaiz tokenized diamonds and precious metals on behalf of Russian banks.

Tokentrust Holdings Ltd. is Atomiaz’s majority shareholder.

Obshchestvo S Ogranichennoy Otvetstvennostyu Veb3 Tekhnologii provided blockchain-based services and platforms for the Russian financial sector, including sanctioned Russian banks.

Obshchestvo S Ogranichennoy Otvetstvennostyu Veb3 Integrator also provided blockchain-based services and platforms for the Russian financial sector, including sanctioned Russian banks.

Igor Veniaminovich Kaigorodov is the majority shareholder for Veb3 Tekhnologii and Veb3 Integrator.

Obshchestvo S Ogranichennoy Otvetstvennostyu Tsentr Obrabotki Elektronnykh Platezhey (TOEP) is a digital currency exchange that operates under the names Netexchange and Netex24, and facilitated payments to OFAC-sanctioned banks including Sberbank and Alfa-Bank, as well as Hydra, the sanctioned darknet market.

Timur Evgenyevich Bukanov is the owner and director of TOEP.

Bitfingroup OÜ is an Estonia-based company likely controlled by Bukanov.

Bitpapa IC FZC LLC is a peer-to-peer (P2P) exchange that facilitated millions in payments for OFAC-designated Russian cryptocurrency businesses, Garantex and Hydra.

In the Chainalysis report on Netex24 and BitPapa, they noted that Netex24 supports off-ramping to sanctioned Russian banks Tinkoff and Sberbank, as well as other similar organizations. Although OFAC did not include any crypto addresses in its designations of Netex24 or Bitpapa, Chainalysis has identified clusters associated with both services. Over the last two years, on-chain data shows that both Netex24 and Bitpapa have facilitated significant sending of funds to sanctioned entities. Darknet markets also make up a significant volume of transaction history, in addition to exchanges without Know Your Customer (KYC) controls, many of which are Russian-language sites offering on and off ramping with sanctioned Russian banks.

Value sent by Netex24 and Bitpapa to sanctioned entities and darknet markets has steadily increased since the start of Russia’s war in Ukraine, whereas value sent to exchanges without KYC guidelines and other illicit services has remained relatively flat.

In addition to facilitating transactions on behalf of larger sanctioned financial services and crypto entities, Netex24 and Bitpapa have also facilitated transactions for various pro-Russian militia and propaganda groups, including MOO Veche, an OFAC designated Russian militia group. All of these entities have been known to operate in the Donetsk, Luhansk, or Crimean regions of Ukraine.

The UAE was one of the first countries in the world to develop a virtual asset regulatory framework and recently was taken off of the FATF grey list. While the company in question was registered as a business in DMCC for the trading of crypto assets, it did not have a regulatory license to operate within the UAE. In addition its licensed was supposed to have expired in September of 2023.